Backdoor attack is a training time attack that embeds a backdoor into a model by poisoning training data (e.g., adding triggers on the images). The state-of-the-art backdoor attacks focus on image classification model [1]}, [2]} and has been recently studied on FL [3]}. Current studies of backdoor attacks in deep generative models (e.g., GAN) train on a poisoned dataset [4]} or input a poisoned noise vector [5]} into the generator so that GAN failed to produce quality synthetic images with similar distribution as the real data. As injecting backdoor to images has been shown more effective [4]}, we suggest a way of attacking federated GAN only through the poisoned data with more details below.
